flowviant 0.114.0 → 0.114.1

package/bin/cli.mjs

@@ -325,7 +325,7 @@ async function uninstallCommand() {
 // repo each is bound to, and which the legacy mirror points at. Needs no
 // network: it reads the store, which is the exact thing a confused person is
 // trying to see. The remedies are named because this listing IS the moment of
-// confusion ("why did it say skadooble?"), not documentation.
+// confusion ("why did it say contoso?"), not documentation.
 async function projectsCommand() {
   const { listStoredProjects, projectLabel } = await import('./lib/credentials.mjs');
   const { connectedOn } = await import('./lib/credentialDate.mjs');
@@ -336,7 +336,7 @@ async function projectsCommand() {
   }
   for (const e of entries) {
     // THE DATE RIDES THE ID, always — this listing exists for the moment
-    // somebody is asking "why did it say skadooble?", and "which of these two
+    // somebody is asking "why did it say contoso?", and "which of these two
     // did I set up last month" is the same question one step on. Absent when
     // nothing recorded one (a credential stored before the field existed);
     // nothing is invented.

package/bin/lib/artifactContracts.mjs

@@ -59,6 +59,25 @@ or, if you are stopping to ask:
 "progress" is REQUIRED on both shapes and REPLACES the previous one whole —
 past tense, plain sentences, no card ids.`;
 
+/**
+ * NOBODY IS AT THIS SCREEN (2026-09-29, the owner: Chrome "kept opening on my
+ * desktop … but me as the user didnt click anything"). A board agent looking
+ * at the page it made started Chrome itself, and a Chrome started on the
+ * default profile hands its window to the person's own running Chrome. The
+ * turn's environment now closes those roads (noWindowEnv.mjs); these words
+ * are for what an environment cannot close — an agent reaching for a window
+ * on purpose — and say how to look without one: headless, a profile of its
+ * own, a screenshot it reads back. `flowviant shot` is not named because
+ * nothing puts `flowviant` on a turn's PATH (an npx or tray-bundled daemon
+ * has none there). Every file-handing kind that draws a page renders
+ * `LOOK_HEADLESS` in its rule 2; the image card renders `NO_WINDOW`.
+ */
+export const NO_WINDOW = `Never open a browser window or any desktop application: this is somebody's
+   own screen, and nobody is at it.`;
+export const LOOK_HEADLESS = `${NO_WINDOW} To look at your page, screenshot it
+   headless with a profile of its own and read the PNG:
+     google-chrome --headless=new --user-data-dir="$(mktemp -d)" --virtual-time-budget=5000 --screenshot=/tmp/<name>.png file://<the page's absolute path>`;
+
 /**
  * THE 3D-MODEL CARD (rewritten 0.107.0, the owner, 2026-09-27: "yeah just
  * glb"). The product is ONE .glb a person downloads and imports; the card
@@ -133,6 +152,8 @@ WHAT TO DO:
 
    Keep the page under 2 MB.
 
+   ${LOOK_HEADLESS}
+
 ${ARTIFACT_CONTRACT_TAIL({
   ask: `If you cannot model it without a DECISION only a person can make — which of
    two directions, what size or style, which asset it stands beside — STOP AND
@@ -171,6 +192,8 @@ WHAT TO DO:
    one slide on each page (break-after: page), so the browser prints it to a
    PDF. Keep it under 2 MB.
 
+   ${LOOK_HEADLESS}
+
 ${ARTIFACT_CONTRACT_TAIL({
   ask: `If you cannot write it without a DECISION only a person can make — who the
    audience is, how long it runs, what it must argue — STOP AND ASK. Do not
@@ -234,6 +257,9 @@ WHAT TO DO:
    no notes, no scripts, no discarded variants. Keep each file under
    ${IMAGE_CAP_WORDS}; if one is larger, save it as WebP or at a smaller size.
 
+   ${NO_WINDOW} Look at a picture through your own tools,
+   never an image viewer.
+
 ${ARTIFACT_CONTRACT_TAIL({
   ask: `If you cannot make it without a DECISION only a person can make — what it
    shows, its style, its size, where it goes — STOP AND ASK. Do not guess. And

package/bin/lib/credentials.mjs

@@ -153,7 +153,7 @@ export function safeName(name) {
  * (2026-09-19).
  *
  * Two projects genuinely named the same thing is not a hypothetical: production
- * held two called "BRIF AI", both bound to the same checkout on one box, so
+ * held two projects with one name, both bound to the same checkout on one box, so
  * `npx flowviant` there offered two IDENTICAL picker rows and the only way to
  * choose between them was to guess. A picker whose options cannot be told apart
  * is not a picker.
@@ -185,9 +185,9 @@ export function projectRowLabel(e, entries) {
  * WHICH STORED PROJECTS SHARE ONE REPO — the duplicate the owner met and could
  * not name (2026-09-23).
  *
- * `npx flowviant machines` printed "BRIF AI" twice, and he read it as two
- * daemons or two "machine profiles" on one box for one project: *"when I go to
- * BRIF AI to disconnect the duplicate, I only see one."* It was two PROJECTS
+ * `npx flowviant machines` printed one project name twice, and he read it as
+ * two daemons or two "machine profiles" on one box for one project: *"when I go
+ * to <the project> to disconnect the duplicate, I only see one."* It was two PROJECTS
  * with one name, both bound to one checkout — and the id-on-every-row rule
  * (2026-09-19) had not made that legible, because two hex prefixes say
  * "different" without saying "same repo". A project's Machines page shows its
@@ -256,8 +256,8 @@ export function boundElsewhere(entries, repoRoot, projectId) {
  */
 export function directoryTakenRefusal(bound, repoRoot, { incoming } = {}) {
   // Every project in the sentence is labelled against the WHOLE set, the
-  // incoming one included: a refusal reading "already connected to BRIF AI,
-  // so BRIF AI was not connected" is the puzzle it exists to end.
+  // incoming one included: a refusal reading "already connected to Acme App,
+  // so Acme App was not connected" is the puzzle it exists to end.
   const all = [...bound, ...(incoming ? [incoming] : [])];
   const names = bound.map((e) => projectRowLabel(e, all));
   const list = names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}` : names[0];
@@ -284,7 +284,7 @@ function normalizeName(s) {
  * WHICH stored project most likely goes with this repo — a HINT for the
  * picker's default, and DELIBERATELY not a licence to serve it. `resolveStored
  * Credential` matches by repo PATH and refuses to guess past that, because
- * serving a project the path did not name is the "it said skadooble in my
+ * serving a project the path did not name is the "it said contoso in my
  * calendar repo" surprise this whole file exists to prevent. A name that
  * matches the repo's folder or its github repo-name is softer evidence — good
  * enough to put the cursor on that row so the answer is one keypress, never
@@ -450,7 +450,7 @@ export function matchStoredProject(ref) {
  *
  * Deliberately NO mirror fallback once more than one project is stored: the
  * mirror is whichever login happened last, and serving it because it was
- * recent is exactly the calendar-says-skadooble surprise this file exists to
+ * recent is exactly the calendar-says-contoso surprise this file exists to
  * end. Two projects means the answer is a QUESTION (or --project, or the
  * repo binding), never recency.
  */
@@ -473,7 +473,7 @@ export function resolveStoredCredential(argv = process.argv, cwd = process.cwd()
 
   // ONE stored project with no binding: the pre-0.55.0 world. Serve it — a
   // headless restart must not hang — but flag it, so a TTY start asks ONCE and
-  // binds, which is what turns "it said skadooble in my calendar repo" into a
+  // binds, which is what turns "it said contoso in my calendar repo" into a
   // question instead of a surprise.
   if (entries.length === 1 && !entries[0].repoRoot) {
     return { entry: entries[0], source: 'only', needsConfirm: Boolean(repoRoot), repoRoot };

package/bin/lib/fleetRoster.mjs

@@ -467,7 +467,7 @@ export function announceFirstPoll(roster) {
     );
     note(c.dim('  wiki + agents stream to THIS project — view its Code canvas in Flowviant.'));
     // Remember the NAME beside the stored credential, so the picker and
-    // `flowviant projects` can say "skadooble" instead of an id — a
+    // `flowviant projects` can say "contoso" instead of an id — a
     // credential saved before the server sent names backfills here. No-op
     // for a --fleet/env token (nothing stored to annotate).
     setStoredProjectName(roster.project.id, roster.project.name);

package/bin/lib/git.mjs

@@ -260,11 +260,11 @@ export function detectBaseRef(repoRoot) {
  * A base ref an agent's worktree can actually be cut from.
  *
  * `origin/<branch>` is the right base when the repo HAS an origin. A repo with
- * no remote (a local-only project — the owner's "Death Note - Roblox",
- * 2026-09-25) has no `origin/*` refs at all, and cutting a worktree from one
- * fails; every agent turn then ended "nothing" in a second. So: the ref itself
- * when it resolves to a commit, else the LOCAL branch of the same name, else
- * the ref unchanged (and the worktree step says why in git's words).
+ * no remote (a local-only project, 2026-09-25) has no `origin/*` refs at
+ * all, and cutting a worktree from one fails; every agent turn then ended
+ * "nothing" in a second. So: the ref itself when it resolves to a commit,
+ * else the LOCAL branch of the same name, else the ref unchanged (and the
+ * worktree step says why in git's words).
  */
 export function usableBaseRef(repoRoot, ref) {
   const resolves = (r) => {

package/bin/lib/machineListing.mjs

@@ -36,14 +36,14 @@
  * the connected flowviants? because im not sure if i have any duplicate or
  * redundant daemons running". Measured the day it was asked: four live daemons
  * across two boxes, two credentials last heard three days ago, and two projects
- * both named "BRIF AI" bound to the same checkout — which is why `npx
+ * with one name bound to the same checkout — which is why `npx
  * flowviant` there offered two identical picker rows. THE PROJECT ID IS
  * THEREFORE ALWAYS PRINTED: it is the only thing that tells those two apart,
  * and the whole listing is worth less without it. **And since 0.95.0 the
  * collision is SAID, not left to be noticed**: the id told him the rows were
  * different projects, and he still read them as one project connected twice
- * ("BRIF AI appears twice meaning I likely have 2 daemon or 'machine
- * profiles' on my machine for the same BRIF AI project"). `renderCollisions`
+ * ("<the project> appears twice meaning I likely have 2 daemon or 'machine
+ * profiles' on my machine for the same <the project> project"). `renderCollisions`
  * prints one line per repo that two projects are bound to, naming both.
  *
  * ── IT IS A RELAY ──
@@ -266,7 +266,7 @@ export function projectPhrase(e) {
 /**
  * TWO PROJECTS ON ONE REPO, SAID OUT LOUD (2026-09-23).
  *
- * The owner ran this command, saw "BRIF AI" twice, and concluded he had two
+ * The owner ran this command, saw one project name twice, and concluded he had two
  * daemons for one project. The id on each row said they were different
  * projects; nothing said they were bound to the SAME checkout, which is the
  * fact that makes it a duplicate rather than two rows. So the listing ends

package/bin/lib/noWindowEnv.mjs

@@ -0,0 +1,104 @@
+/**
+ * A TURN NOBODY IS SITTING AT PUTS NO WINDOW ON ANYBODY'S SCREEN (2026-09-29).
+ *
+ * The owner, on WSL: Chrome "kept opening on my desktop … but me as the user
+ * didnt click anything". Board agents checking their three.js pages started
+ * Chrome themselves, and an inherited environment gives such a process three
+ * roads to the person's screen:
+ *  · a Chrome started without --user-data-dir takes the DEFAULT profile, and
+ *    while the person's own Chrome runs on it the new process hands its
+ *    command line to that one through the profile's SingletonSocket — taken
+ *    before any display is opened (measured) — so the PERSON'S Chrome opens
+ *    the window, and no display variable of ours is involved;
+ *  · a headed browser, Playwright's `headless: false`, any GUI program draws
+ *    wherever DISPLAY / WAYLAND_DISPLAY point, and WSLg points them at the
+ *    Windows desktop;
+ *  · xdg-open, Python's webbrowser, a dev server's --open honour BROWSER, which
+ *    on WSL is usually the Windows browser.
+ *
+ * So every turn but a Terminal tab's — the one lane where a person at the
+ * keyboard may ask for a window — runs with:
+ *  · DISPLAY and WAYLAND_SOCKET removed, and WAYLAND_DISPLAY set EMPTY rather
+ *    than removed: unset, libwayland falls back to `$XDG_RUNTIME_DIR/wayland-0`
+ *    (measured: a client with it unset connected there), and that is exactly
+ *    the socket WSLg keeps; empty names no socket, a Chrome that picks Wayland
+ *    from it fails "Failed to connect to Wayland display" and exits (measured),
+ *    and xdg-open reads empty as no display at all;
+ *  · BROWSER=none, childEnv.mjs's word for the same thing;
+ *  · a browser home of its own: CHROME_CONFIG_HOME, the root Chrome and
+ *    Chromium put their default profile under (chrome_paths_linux.cc), and
+ *    CHROME_USER_DATA_DIR, the profile itself (chrome_main_delegate.cc) — the
+ *    one a fork like Brave still honours where it ignores the first
+ *    (measured) — so a browser the agent starts bare opens a profile nobody
+ *    else is running and can never reach the person's.
+ *
+ * Nothing that runs here needs what is removed: the CLIs' own headless modes
+ * (`claude -p`, `codex exec`) and headless browsers run without a display
+ * (measured). XDG_CONFIG_HOME is deliberately NOT moved: it is where Claude,
+ * Codex and git keep their own configuration.
+ *
+ * What an environment cannot stop is an agent that runs a Windows program on
+ * purpose through WSL interop (`explorer.exe`, `cmd.exe /c start`); the kind
+ * contracts ask it not to (artifactContracts.mjs, `NO_WINDOW`).
+ */
+import { lstatSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+/** Removed outright; WAYLAND_DISPLAY is kept but emptied (see above). */
+export const WINDOW_ENV_REMOVED = Object.freeze(['DISPLAY', 'WAYLAND_SOCKET']);
+
+/** A copy of `env` a turn nobody is sitting at runs with. Never mutates its
+ *  input. `browserHome` is the directory its browsers keep their profile in. */
+export function withoutWindows(env, browserHome = null) {
+  const out = { ...(env ?? {}) };
+  for (const k of WINDOW_ENV_REMOVED) delete out[k];
+  out.WAYLAND_DISPLAY = '';
+  out.BROWSER = 'none';
+  if (browserHome) {
+    out.CHROME_CONFIG_HOME = browserHome;
+    out.CHROME_USER_DATA_DIR = join(browserHome, 'user-data');
+  }
+  return out;
+}
+
+/**
+ * AN AGENT'S BROWSER HOME is kept beside its Codex home, in its worktree's
+ * private git dir: never committed, the same profile turn after turn, and
+ * removed with the worktree when the agent retires. The pre-review and the
+ * project check stand in the same worktree for the same agent, and take it
+ * too. Null when there is no git dir to hold it.
+ */
+export const agentBrowserHome = (sessionMetaPath, wt, agentId) =>
+  sessionMetaPath?.(wt, 'flowviant-agent-browser', agentId) ?? null;
+
+/**
+ * The directory, made: `kept` when a lane has one (0700, never removed here),
+ * else one of this turn's own that `cleanup` removes. A kept path that is not
+ * a real directory is replaced, never followed; one that cannot be made falls
+ * back to a turn's own. Never throws — the turn runs without a browser home
+ * sooner than not at all, and its display variables are gone either way.
+ */
+export function openBrowserHome(kept) {
+  if (kept) {
+    try {
+      try { if (!lstatSync(kept).isDirectory()) rmSync(kept, { force: true }); } catch { /* absent */ }
+      mkdirSync(kept, { recursive: true, mode: 0o700 });
+      return { dir: kept, cleanup: () => {} };
+    } catch { /* fall through to a turn's own */ }
+  }
+  try {
+    const dir = mkdtempSync(join(tmpdir(), 'flowviant-browser-'));
+    let removed = false;
+    return {
+      dir,
+      cleanup: () => {
+        if (removed) return;
+        removed = true;
+        try { rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ }
+      },
+    };
+  } catch {
+    return { dir: null, cleanup: () => {} };
+  }
+}

package/bin/lib/projectToolRuntimes.mjs

@@ -15,24 +15,51 @@
  * projectTools.mjs. projectTools.test.mjs pins every transport word to here.
  */
 
-import { existsSync, mkdirSync, readFileSync, readdirSync, symlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 
 export const toml = (value) => JSON.stringify(String(value));
 
-/** Keep personal Codex files, but do not copy its project trust grants. An
- * untrusted worktree's .codex/config.toml is ignored by Codex 0.156.1. */
-function isolatedCodexHome(dir, env, worktree) {
-  const source = resolve(env.CODEX_HOME || join(homedir(), '.codex'));
-  const dest = join(dir, 'codex-home');
-  mkdirSync(dest, { mode: 0o700 });
-  if (existsSync(source)) {
-    for (const name of readdirSync(source)) {
-      if (name === 'config.toml') continue;
-      symlinkSync(join(source, name), join(dest, name));
-    }
+/**
+ * ONE LINK PER PERSONAL ENTRY, MADE OR MENDED IN PLACE (2026-09-29). A home
+ * that outlives its turn is refreshed rather than rebuilt, so it must end up
+ * exactly what a fresh build would link: a link already right stays, a link
+ * pointing anywhere else is re-pointed, and a real file or directory standing
+ * where a personal entry belongs — Codex rewrote a link by rename, or made its
+ * own before the person's existed — gives way to the link, because the
+ * personal copy is the one login and the one store (one login per CLI). A
+ * racing refresh that made the same link first is not an error.
+ */
+function linkPersonalEntry(target, link) {
+  let st = null;
+  try { st = lstatSync(link); } catch { /* absent: link it */ }
+  if (st?.isSymbolicLink() && readlinkSync(link) === target) return;
+  if (st) rmSync(link, { recursive: true, force: true }); // never follows a link
+  try {
+    symlinkSync(target, link);
+  } catch (error) {
+    if (error?.code !== 'EEXIST' || readlinkSync(link) !== target) throw error;
   }
+}
+
+/**
+ * Keep personal Codex files, but do not copy its project trust grants. An
+ * untrusted worktree's .codex/config.toml is ignored by Codex 0.156.1.
+ *
+ * `dest` IS REFRESHED IN PLACE, NEVER ASSUMED EMPTY (2026-09-29). An agent's
+ * home is kept between its turns (prepareAgentTools' `codexHome`), because
+ * Codex's shared thread index (`state_5.sqlite`, reached through the link)
+ * records each rollout under the CODEX_HOME in force, unresolved: a home that
+ * died with its turn left the agent's pinned thread pointing into a deleted
+ * directory, and the next card's `resume <id>` failed "no rollout found".
+ * So every personal entry is (re)linked, every link whose entry left the
+ * personal home is dropped, config.toml is rewritten whole each turn (the
+ * worktree's skills can change between turns), and what Codex made here
+ * itself under a name the person has not got is kept.
+ */
+function isolatedCodexHome(dest, env, worktree) {
+  const source = resolve(env.CODEX_HOME || join(homedir(), '.codex'));
   const configPath = join(source, 'config.toml');
   const sourceConfig = existsSync(configPath) ? readFileSync(configPath, 'utf8') : '';
   const topLevel = sourceConfig.split(/^\s*\[/m, 1)[0];
@@ -65,7 +92,33 @@ function isolatedCodexHome(dir, env, worktree) {
       throw new Error('Cannot isolate Codex project skills with inline skills.config');
     for (const skill of worktreeSkills) config += `\n[[skills.config]]\npath = ${toml(skill)}\nenabled = false\n`;
   }
-  writeFileSync(join(dest, 'config.toml'), config, { mode: 0o600 });
+
+  // The home itself, only once the config is decided: a refused turn touches
+  // nothing here. A home that is not a real directory is not ours to write
+  // through — a link standing here would carry what follows somewhere else.
+  try { if (!lstatSync(dest).isDirectory()) rmSync(dest, { force: true }); } catch { /* absent */ }
+  mkdirSync(dest, { recursive: true, mode: 0o700 });
+  chmodSync(dest, 0o700);
+  const personal = existsSync(source) ? readdirSync(source).filter((name) => name !== 'config.toml') : [];
+  for (const name of personal) linkPersonalEntry(join(source, name), join(dest, name));
+  const linked = new Set(personal);
+  for (const name of readdirSync(dest)) {
+    if (linked.has(name) || name === 'config.toml') continue;
+    // Only a LINK is ours to drop: a real entry under a name the person has
+    // not got is Codex's own (its sessions, on a box whose personal home had
+    // none yet), and this agent's threads live in it.
+    try { if (lstatSync(join(dest, name)).isSymbolicLink()) rmSync(join(dest, name), { force: true }); } catch { /* gone */ }
+  }
+  // Written beside and RENAMED over, so a config.toml that is somehow a link
+  // is replaced as an entry and never written through: the personal
+  // config.toml is the one file this home must never reach.
+  const staged = join(dest, `.config.toml.${process.pid}.${Date.now()}`);
+  try {
+    writeFileSync(staged, config, { mode: 0o600, flag: 'wx' });
+    renameSync(staged, join(dest, 'config.toml'));
+  } finally {
+    rmSync(staged, { force: true });
+  }
   return { path: dest, personalDeveloperInstructions };
 }
 
@@ -85,8 +138,9 @@ function reviewedClaudePlugin(dir, snapshot) {
 
 /**
  * The table. `refuseMcp(config)` names why this runtime cannot take one MCP
- * configuration it otherwise could; `prepare(dir, snapshot, env, worktree)`
- * returns the runner-specific part of prepareAgentTools' result.
+ * configuration it otherwise could; `prepare(dir, snapshot, env, worktree,
+ * kept)` returns the runner-specific part of prepareAgentTools' result — under
+ * `dir`, which dies with the turn, except what `kept` names a lasting place for.
  */
 const TOOL_RUNTIMES = {
   claude: {
@@ -99,8 +153,11 @@ const TOOL_RUNTIMES = {
     mcp: true,
     skills: true,
     refuseMcp: (config) => (config.type === 'sse' ? 'Codex cannot take SSE MCP' : null),
-    prepare: (dir, _snapshot, env, worktree) => {
-      const isolated = isolatedCodexHome(dir, env, worktree);
+    // The agent's own lasting home when the caller has one (2026-09-29: its
+    // threads are indexed under it — see isolatedCodexHome), else one that
+    // dies with the turn, as every home did before.
+    prepare: (dir, _snapshot, env, worktree, kept) => {
+      const isolated = isolatedCodexHome(kept?.codexHome ?? join(dir, 'codex-home'), env, worktree);
       return { codexHome: isolated.path, personalDeveloperInstructions: isolated.personalDeveloperInstructions };
     },
   },
@@ -132,7 +189,8 @@ export function skillsRefusal(runner) {
   return runner === 'none' ? 'no installed CLI can take instructions' : `${runner} cannot take instructions`;
 }
 
-/** The runner-specific files a turn needs, written under `dir`. */
-export function prepareForRunner(runner, dir, snapshot, env, worktree) {
-  return { pluginDir: null, codexHome: null, personalDeveloperInstructions: false, ...(rowFor(runner).prepare?.(dir, snapshot, env, worktree) ?? {}) };
+/** The runner-specific files a turn needs, written under `dir` — or, for what
+ *  `kept` names, where the caller keeps it between turns. */
+export function prepareForRunner(runner, dir, snapshot, env, worktree, kept = {}) {
+  return { pluginDir: null, codexHome: null, personalDeveloperInstructions: false, ...(rowFor(runner).prepare?.(dir, snapshot, env, worktree, kept) ?? {}) };
 }

package/bin/lib/projectTools.mjs

@@ -99,8 +99,16 @@ export function readBaseTools(root, ref, env = process.env) {
 
 const expand = (value, env) => String(value).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, key) => env[key] ?? '');
 
-/** Temporary per-turn files are removed after the last retry. No personal CLI config is written. */
-export function prepareAgentTools(snapshot, runner, env = process.env, worktree = null) {
+/**
+ * Temporary per-turn files are removed after the last retry. No personal CLI config is written.
+ *
+ * `codexHome` is the AGENT'S OWN CODEX_HOME, kept between its turns
+ * (2026-09-29): a place the caller owns, refreshed here each turn and never
+ * removed by `cleanup`, because Codex indexes a thread under the home it ran
+ * in and the next card resumes that thread. Absent, a Codex turn gets a home
+ * that dies with it.
+ */
+export function prepareAgentTools(snapshot, runner, env = process.env, worktree = null, { codexHome: keptCodexHome = null } = {}) {
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-agent-tools-'));
   const usable = snapshot.tools.filter((t) => t.state === 'ready' && mcpRefusal(runner, t.config) == null);
   const mcpServers = {};
@@ -142,7 +150,7 @@ export function prepareAgentTools(snapshot, runner, env = process.env, worktree
   ].filter(Boolean).join('\n\n');
   let prepared;
   try {
-    prepared = prepareForRunner(runner, dir, snapshot, env, worktree);
+    prepared = prepareForRunner(runner, dir, snapshot, env, worktree, { codexHome: keptCodexHome });
   } catch (error) {
     rmSync(dir, { recursive: true, force: true });
     throw error;

package/bin/lib/prompts.mjs

@@ -20,7 +20,7 @@
 import { agentTaskKindOf } from './agentTaskKinds.mjs';
 // A card's type (0.106.0) likewise: the table holds the words, this file prints them.
 import { AGENT_TASK_TYPES, agentTaskTypeFor, agentTaskTypeOf } from './agentTaskTypes.mjs';
-import { ARTIFACT_CONTRACT_TAIL, SYSTEM_AGENT_DECK, SYSTEM_AGENT_IMAGE, SYSTEM_AGENT_MODEL } from './artifactContracts.mjs';
+import { ARTIFACT_CONTRACT_TAIL, LOOK_HEADLESS, SYSTEM_AGENT_DECK, SYSTEM_AGENT_IMAGE, SYSTEM_AGENT_MODEL } from './artifactContracts.mjs';
 import { isLibraryReference } from './knowledgeLibrary.mjs';
 import { readCardThread } from './cardThread.mjs';
 import { AGENT_FILE_LINE_MAX, AGENT_FILES_PER_MESSAGE_MAX, CARD_FILES_PER_TURN_MAX } from './agentFiles.mjs';
@@ -1022,6 +1022,8 @@ WHAT TO DO:
    images are data: URIs or inline SVG. Several pages asked for in one card
    go in the ONE file (sections, or tabs you script). Keep it under 2 MB.
 
+   ${LOOK_HEADLESS}
+
 ${ARTIFACT_CONTRACT_TAIL({
   ask: `If you cannot draw it without a DECISION only a person can make — which of
    two directions, which page, what the content should say — STOP AND ASK. Do

package/bin/lib/resumeLost.mjs

@@ -32,6 +32,12 @@ const RESUME_LOST = [
   /session .{0,80}not found/i,
   /conversation .{0,80}not found/i,
   /thread .{0,80}not found/i,
+  // Codex 0.156's words for a pinned thread whose rollout file is gone
+  // (2026-09-29): "Error: thread/resume: thread/resume failed: no rollout
+  // found for thread id <id> (code -32600)" on stderr, exit 1, no event on
+  // stdout. Every agent thread filed under a deleted per-turn /tmp home says
+  // exactly this, and none of the phrases above matched it.
+  /no rollout found/i,
   /trajectory not found/i,
 ];
 /**

package/bin/lib/runTurn.mjs

@@ -13,6 +13,7 @@
 import { spawn } from 'node:child_process';
 import { runtimeById } from './runtimes.mjs';
 import { withoutMachineCredentials } from './machineEnv.mjs';
+import { openBrowserHome, withoutWindows } from './noWindowEnv.mjs';
 import { resolveTurnProfile } from './turnProfile.mjs';
 import { claudePermFor } from './claudePosture.mjs';
 import { handleStreamLine } from './claudeStream.mjs';
@@ -38,9 +39,18 @@ const CODEX_MODEL_READ_MS = 1_500;
  * the MCP config file. So those two names, and only those, are removed —
  * by the one rule in machineEnv.mjs, which the project check obeys too.
  */
-export function cliEnv(mcpEnv) {
+/**
+ * …AND, UNLESS A PERSON IS AT THE KEYBOARD, NO WAY TO A WINDOW (2026-09-29).
+ * `display: true` is the Terminal tab's alone: a person typing there may ask
+ * for a window and gets their own environment. Every other turn — an agent's,
+ * its pre-review, the planner, the wiki, intake, the capture chat, and any
+ * lane added later that does not say otherwise — runs under
+ * `withoutWindows` (noWindowEnv.mjs), its browsers in `browserHome`.
+ */
+export function cliEnv(mcpEnv, { display = false, browserHome = null } = {}) {
   // After the merge, so an mcpEnv can never smuggle one back in.
-  return withoutMachineCredentials({ ...process.env, ...(mcpEnv ?? {}) });
+  const env = withoutMachineCredentials({ ...process.env, ...(mcpEnv ?? {}) });
+  return display === true ? env : withoutWindows(env, browserHome);
 }
 
 // One Claude Code turn. Output is captured (for sentinel detection) and streamed
@@ -53,7 +63,7 @@ export function cliEnv(mcpEnv) {
 // `onActivity` so the caller can forward progress. Build-agent turns leave it
 // off and keep the raw text passthrough + line sentinels.
 export function runTurn(opts) {
-  const { prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, agentTools, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onRateLimit, onModel, onThreadId, onAnswer, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId } = opts;
+  const { prompt, resume, system, cwd, mcpConfig, mcpArgs, mcpEnv, agentTools, runtime = 'claude', label, onSpawn, streamJson, answerFromResult, onActivity, onToolEvent, onInit, onUsage, onRateLimit, onModel, onThreadId, onAnswer, vaultDir, knowledgeDir, resultSchemaArgs, model, effort, adoptResumeId, resumeThreadId, resumeConversationId, display, browserHome } = opts;
   /**
    * AFTER THE TEARDOWN, NO TURN STARTS AND NO TURN ENDS (standDownGate.mjs).
    * A stand-down that drains a deploy keeps this process alive; without this
@@ -195,6 +205,11 @@ export function runTurn(opts) {
     // Which credential is correct, and whether an account may be shared, is
     // between the operator and the vendor. Flowviant does not detect it and does
     // not enforce it; it runs the CLI the ordinary way and relays what happens.
+    //
+    // A turn nobody is sitting at keeps its browsers in a home of its own —
+    // the lane's kept one (an agent's), else this spawn's, removed when the
+    // CLI closes. See `cliEnv`.
+    const browser = display === true ? null : openBrowserHome(browserHome);
     const child = spawn(rt.bin, args, {
       cwd,
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -219,10 +234,15 @@ export function runTurn(opts) {
       detached: true,
       // Only ADDS to the environment (the worker token, for runtimes that read
       // it from there). Never replaces it: the CLI's own credentials live in
-      // this environment, and handing it a curated one signs it out. The one
-      // thing it REMOVES is this daemon's machine credential — see `cliEnv`.
-      env: cliEnv(mcpEnv),
+      // this environment, and handing it a curated one signs it out. What it
+      // REMOVES is this daemon's machine credential and, for a turn nobody is
+      // sitting at, every way to a window — see `cliEnv`.
+      env: cliEnv(mcpEnv, { display: display === true, browserHome: browser?.dir }),
     });
+    if (browser) {
+      child.once('close', browser.cleanup);
+      child.once('error', browser.cleanup);
+    }
     onSpawn?.(child);
     // When this turn began, for the Codex rollout read: a `turn_context` older
     // than this is a previous turn's (turnModel.mjs).

package/bin/lib/runtimeCodex.mjs

@@ -243,9 +243,10 @@ export const CODEX_RUNTIME = {
       // one under `$CODEX_HOME/generated_images/…` and says the path (the
       // binary's own words: "Generated images are saved to … by default. If
       // you need to use a generated image at another path, copy it"). An agent
-      // turn's CODEX_HOME is its isolated per-turn home (projectToolRuntimes);
-      // `:root` reads admit it, so the agent copies what it keeps into the one
-      // writable directory, where the artifact scan finds it.
+      // turn's CODEX_HOME is the agent's own isolated home (projectToolRuntimes,
+      // kept per agent since 2026-09-29); `:root` reads admit it, so the agent
+      // copies what it keeps into the one writable directory, where the
+      // artifact scan finds it.
       //
       // IMAGE GENERATION IS SWITCHED ON HERE AND ONLY HERE — a decision. This
       // is the one turn whose card asks for pictures, so it must not depend

package/bin/lib/startProject.mjs

@@ -33,7 +33,7 @@ async function reexecAfterLogin() {
 
 // TWO ROWS THAT READ ALIKE ARE NOT A CHOICE. `projectRowLabel` adds the id and
 // the connected date to the COLLIDING rows only — production held two projects
-// both called "BRIF AI", both bound to the same checkout, so this picker
+// with one name, both bound to the same checkout, so this picker
 // offered two identical lines and the only way to answer was to guess. See
 // credentials.mjs for why the suffix is not on every row. (That exact case is
 // a refusal now rather than a picker — a directory serves one project — but
@@ -62,7 +62,7 @@ export async function resolveStartProject({ dirGiven }) {
   // binds it, and a headless start with no unambiguous answer refuses in words
   // that name every stored project and every way out. The one thing this block
   // must never do is serve a project the resolution did not name — "it said
-  // skadooble in my calendar repo" is the confusion this exists to end.
+  // contoso in my calendar repo" is the confusion this exists to end.
   // A RESTART IS NOT A PERSON. `reexec` (update.mjs) inherits stdio, so an
   // auto-updated daemon's child sees two TTYs; without this it would stop on the
   // binding confirm below and the machine would stay dark until somebody typed a
@@ -122,7 +122,7 @@ export async function resolveStartProject({ dirGiven }) {
 
       const loginLabel = `connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (${terminalCommand('login')})`;
       // WHICH ONE LOOKS RIGHT — a pre-selection, never an auto-serve. The resolver
-      // refuses to serve a project the repo PATH did not name (the skadooble law);
+      // refuses to serve a project the repo PATH did not name (the contoso law);
       // this only decides which row the cursor starts on, using the repo's folder
       // name and its github repo-name against the stored project names. A unique
       // match becomes ONE keypress; a wrong guess costs nothing, because the human
@@ -136,7 +136,7 @@ export async function resolveStartProject({ dirGiven }) {
 
       // Bounded like the confirm below, and for the same reason — but silence
       // means something DIFFERENT here and the difference is load-bearing. There
-      // is a real ambiguity to resolve; serving a guess is the skadooble bug.
+      // is a real ambiguity to resolve; serving a guess is the contoso bug.
       // So no answer REFUSES, which is exactly what this branch already does
       // headless, and the message says how to answer without being present.
       let chosen = null; // 0-based into [...choices, login]
@@ -220,7 +220,7 @@ export async function resolveStartProject({ dirGiven }) {
   } else if (!externalToken && CREDENTIAL.needsConfirm && interactive) {
     // ONE stored project, never tied to a repo — the pre-0.55.0 world. Ask once;
     // yes binds and every later start is silent. This is the exact question
-    // whose absence had a calendar checkout serving skadooble.
+    // whose absence had a calendar checkout serving contoso.
     //
     // AND IT TIMES OUT, because a prompt on a start path is a way for a machine
     // to go dark. `FLOWVIANT_REEXEC` above covers the restart THIS version
@@ -240,7 +240,7 @@ export async function resolveStartProject({ dirGiven }) {
     //    not, which is the whole reason this product has exactly one refusal.
     //  · DO NOT BIND, because binding is the thing the question was FOR. Nobody
     //    answered, so nothing is cemented; the next human start asks again. That
-    //    keeps the skadooble case fixed for the person who is actually looking,
+    //    keeps the contoso case fixed for the person who is actually looking,
     //    which is the only person it could ever have been fixed for.
     const creds = await import('./credentials.mjs');
     const label = creds.projectLabel(CREDENTIAL.entry);

package/bin/lib/work.mjs

@@ -330,6 +330,8 @@ export function createWorkManager({
     postBestEffort,
     workChildren,
     groupKillChildren,
+    // Only to find the agent's browser profile (noWindowEnv.mjs).
+    sessionMetaPath,
   });
   const { runPrecheck } = createWorkAgentPrecheck({
     baseRef,

package/bin/lib/workAgentCheck.mjs

@@ -17,6 +17,7 @@ import { warn } from './ui.mjs';
 import { ARTIFACT_DIR, artifactTypeFor } from './artifacts.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
 import { withoutMachineCredentials } from './machineEnv.mjs';
+import { agentBrowserHome, openBrowserHome, withoutWindows } from './noWindowEnv.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
 import { workLanesStopped } from './standDownGate.mjs';
 
@@ -85,11 +86,14 @@ export function clearNonArtifacts(wt) {
  * authenticates with; everything else is what the agent's own turn saw when it
  * ran the same tests.
  */
-export function checkEnv(env = process.env) {
-  return withoutMachineCredentials(env);
+export function checkEnv(env = process.env, browserHome = null) {
+  // …and, like that turn since 2026-09-29, no way to a window: a test run
+  // nobody is watching that opens a headed browser or an HTML report opens it
+  // on nobody's behalf (noWindowEnv.mjs). The agent's own browser profile.
+  return withoutWindows(withoutMachineCredentials(env), browserHome);
 }
 
-export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, groupKillChildren }) {
+export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, groupKillChildren, sessionMetaPath }) {
   const AGENT_CHECK_DONE_URL = fleetEndpoint('agent-check-done', FLEET_URL);
 
   // ── THE PROJECT'S OWN CHECK, and the MERGE ─────────────────────────────────
@@ -142,6 +146,7 @@ export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, g
       warn(
         `agent ${agentId}: removed ${cleared.length} non-artifact file(s) from ${ARTIFACT_DIR} before the check — ${cleared.slice(0, 5).join(', ')}`
       );
+    const browser = openBrowserHome(agentBrowserHome(sessionMetaPath, wt, agentId));
     const out = await new Promise((resolve) => {
       let text = '';
       let done = false;
@@ -178,7 +183,7 @@ export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, g
           shell: true,
           detached: true,
           stdio: ['ignore', 'pipe', 'pipe'],
-          env: checkEnv(),
+          env: checkEnv(process.env, browser.dir),
         });
         /**
          * …AND IT IS TRACKED, so a stop or a takeover takes it with them.
@@ -266,6 +271,7 @@ export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, g
         finish(code === 0 ? 'passed' : 'failed');
       });
     });
+    browser.cleanup();
     await postCheck({
       agentId,
       status: out.status,

package/bin/lib/workAgentPrecheck.mjs

@@ -20,6 +20,7 @@ import { removeProbeTranscript } from './runtimeCapabilities.mjs';
 import { taskIdsFromMessage } from './worktreeDiff.mjs';
 import { limitLine } from './cliLimit.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { agentBrowserHome } from './noWindowEnv.mjs';
 
 export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workChildren }) {
   const AGENT_PRECHECK_URL = fleetEndpoint('agent-precheck', FLEET_URL);
@@ -257,6 +258,9 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
         profile: 'consult',
         cwd: wt,
         runtime: rt,
+        // The agent's own browser profile, in the worktree this reader stands
+        // in; no display either way (noWindowEnv.mjs, 2026-09-29).
+        browserHome: agentBrowserHome(sessionMetaPath, wt, agentId),
         // NO `resume`, AND THAT IS THE FEATURE. A resumed turn would be the
         // agent grading its own homework out of its own context; this is a
         // stranger reading a diff.

package/bin/lib/workAgentTurnExecution.mjs

@@ -38,6 +38,7 @@ import { brainFor } from './workBrain.mjs';
 import { begunTurnRefusal } from './workAgentTurnBegun.mjs';
 import { agentTurnSettlement } from './workAgentTurnOutcome.mjs';
 import { ensureArtifactDir } from './artifacts.mjs';
+import { agentBrowserHome } from './noWindowEnv.mjs';
 
 export function createAgentTurnExecution({
   baseRef,
@@ -286,6 +287,23 @@ export function createAgentTurnExecution({
       rt === 'codex'
         ? Boolean(codexResumeId)
         : rt === 'claude' && Boolean(ranMarker && existsSync(ranMarker));
+    /**
+     * …AND THE HOME THAT THREAD IS FILED UNDER, KEPT PER AGENT (2026-09-29).
+     *
+     * Codex's thread index records each rollout under the CODEX_HOME the turn
+     * ran with, as that path — not the personal store the link leads to — so
+     * the per-turn home in /tmp every turn used to get died with its turn and
+     * took the pinned thread with it: the next card's `resume` failed "no
+     * rollout found" and the agent went to Stuck. Beside the thread marker,
+     * in the worktree's private git dir: outside the working tree (never
+     * committed, never seen by `git add -A`), refreshed by every turn and
+     * removed only with the worktree, when the agent retires and its threads
+     * stop mattering. One agent runs one turn at a time (its place's writer
+     * lock), so no two turns refresh it at once. Null (no git dir to hold it)
+     * is the per-turn home again, and a lost resume then runs once fresh.
+     */
+    const codexAgentHome =
+      rt === 'codex' ? sessionMetaPath(wt, 'flowviant-agent-codex-home', agentId) : null;
 
     /**
      * THE TURN'S FILES, ON DISK BEFORE THE PROMPT NAMES THEM (0.112.0) — the
@@ -376,6 +394,15 @@ export function createAgentTurnExecution({
 
     let out = '';
     let child = null;
+    /**
+     * EVERY CHILD THIS TURN SPAWNED, not only the last (2026-09-29). A lost
+     * resume runs once more fresh (runTurnResumingOnce), so a turn can own two
+     * CLIs, and `child` names only the second: the first stayed in
+     * `workChildren` for the life of the daemon — one phantom live turn per
+     * retry, held against the machine's ceiling, and `workBusy()` true for
+     * ever, which holds the self-update and the tray's install for ever.
+     */
+    const spawnedChildren = new Set();
     /**
      * WHAT THIS TURN SPENT, AS THE CLI COUNTED IT (2026-09-19).
      *
@@ -409,7 +436,7 @@ export function createAgentTurnExecution({
     try {
       // A turn reads the base ref afresh. Changes the agent has made to its
       // own worktree cannot silently change the next turn's tools.
-      projectTools = prepareAgentTools(readBaseTools(repoRoot, baseRef()), rt, process.env, wt);
+      projectTools = prepareAgentTools(readBaseTools(repoRoot, baseRef()), rt, process.env, wt, { codexHome: codexAgentHome });
       const agentTurnArgs = {
         prompt:
           job.kind === 'task' && job.task
@@ -450,6 +477,11 @@ export function createAgentTurnExecution({
         }) + (projectTools.instructions ? `\n\n${projectTools.instructions}` : ''),
         agentTools: projectTools,
         ...(projectTools.codexHome ? { mcpEnv: { CODEX_HOME: projectTools.codexHome } } : {}),
+        // NOBODY IS AT THIS SCREEN (2026-09-29): no display, BROWSER=none, and
+        // a browser profile of the agent's own, kept beside its Codex home —
+        // so a Chrome it starts to look at its page never reaches the
+        // person's (noWindowEnv.mjs).
+        browserHome: agentBrowserHome(sessionMetaPath, wt, agentId),
         ...(posture === 'build' && rt === 'claude'
           ? { mcpArgs: ['--strict-mcp-config', '--mcp-config', projectTools.mcpPath] }
           : posture === 'build' && rt === 'codex'
@@ -531,6 +563,7 @@ export function createAgentTurnExecution({
         },
         onSpawn: (ch) => {
           child = ch;
+          spawnedChildren.add(ch);
           // The AGENT it serves — what the machine snapshot charges this
           // child's memory to.
           workChildren.set(ch, agentId);
@@ -585,7 +618,7 @@ export function createAgentTurnExecution({
        */
       trace.stop();
       await trace.flush(TRACE_FINAL_FLUSH_MS);
-      if (child) workChildren.delete(child);
+      for (const ch of spawnedChildren) workChildren.delete(ch);
       if (agentChildren.get(place) === child) agentChildren.delete(place);
       if (ranMarker && rt === 'claude') {
         try {

package/bin/lib/workSessionTurns.mjs

@@ -694,6 +694,11 @@ export function createWorkSessionTurns({
               cwd: dir.wt,
               mcpArgs: mcp.args,
               mcpEnv: mcp.env,
+              // A PERSON AT THE KEYBOARD MAY ASK FOR A WINDOW (2026-09-29): a
+              // Terminal tab keeps its environment's display. The capture chat
+              // does not — it only reads and stages cards, and the person
+              // talking to it may be on a phone (noWindowEnv.mjs).
+              display: !captureTab,
               runtime: rt.id,
               label: c.cyan('[tab]'),
               // Only codex announces one (thread.started); held here so the id

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.114.0",
+  "version": "0.114.1",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {